Skip to content

Every image stage 06 packs has 4096-byte blocks, the size dm-verity reads it in #531

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DevomB merged 1 commit into from
Oct 15, 2026
Merged

Every image stage 06 packs has 4096-byte blocks, the size dm-verity reads it in #531

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion build/stages/06-iso.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -332,10 +332,12 @@ EOF

# make_ext4 TREE IMAGE BYTES UUID [LABEL]: the sysroot's mke2fs (1.47.1), which clamps every time it
# writes to SOURCE_DATE_EPOCH, in the chroot; TREE and IMAGE are under the work tree's images/.
# Blocks of 4096 bytes, the size dm-verity reads every image in: ext4 refuses a smaller block on
# that device (EINVAL), and mke2fs.conf gives a file system under 512 MiB blocks of 1024.
make_ext4() {
rm -f "$2"; truncate -s "$3" "$2"
env KRYPTIK_ROOT="$KRYPTIK_ROOT" KRYPTIK_WORK="$KRYPTIK_WORK" KRYPTIK_SOURCES="$KRYPTIK_SOURCES" NO_COLOR=1 \
"$CHROOTD" run /usr/sbin/mke2fs -q -F -t ext4 -L "${5:-kryptik-root}" -O '^has_journal' -U "$4" \
"$CHROOTD" run /usr/sbin/mke2fs -q -F -t ext4 -b 4096 -L "${5:-kryptik-root}" -O '^has_journal' -U "$4" \
-E "root_owner=0:0,hash_seed=$4" -d "/kryptik-work${1#"$KRYPTIK_WORK"}" "/kryptik-work${2#"$KRYPTIK_WORK"}" \
> /dev/null
}
Expand Down Expand Up @@ -386,6 +388,8 @@ pack_image() {
cmp -s "$img" "${img}.again" || { echo "FAIL: two mke2fs runs over image ${name} wrote different images" >&2; return 1; }
rm -f "${img}.again"
fi
[[ "$(dumpe2fs -h "$img" 2>/dev/null | sed -n 's/^Block size: *//p')" == 4096 ]] \
|| { echo "FAIL: image ${name} is not of 4096-byte blocks, which dm-verity reads it in" >&2; return 1; }
local data_blocks=$(( fs_bytes / 4096 ))
local salt; salt="$(sha256_of "$img")"
local total=$(( fs_bytes + fs_bytes / 64 + 4 * 1024 * 1024 ))
Expand Down
5 changes: 3 additions & 2 deletions docs/design/software-delivery.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,8 +215,9 @@ up ADR-001 in the zones where the applications run.
stage 04, so changing them rebuilds no image, and a kept image's tree is
checked against the root again. A release builds every image from nothing.
- **Packed.** Stage 06 makes `images-<release>/<name>.img` the way it
makes the root (ext4 without a journal, then the verity tree, with a
salt and UUID derived from the content), runs the root's artifact audit
makes the root (ext4 without a journal in 4096-byte blocks, the size
dm-verity reads it in, then the verity tree, with a salt and UUID derived
from the content), runs the root's artifact audit
over it with the image's own accepted findings
(`build/images/NAME.accepted`, each with its reason) or none, and the
image's own program list, after leaving out what `build/images/NAME.strip`
Expand Down
Loading